Browse All CVEs
33,232 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-0502 |
medium | 5.4 | 0.0012 | 2026-10-29 | Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform | |
CVE-2026-27682 |
medium | 6.1 | 0.0022 | 2026-10-29 | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application S | |
CVE-2026-34258 |
medium | 4.7 | 0.0025 | 2026-10-29 | SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameter | |
CVE-2026-34259 |
high | 8.2 | 0.0020 | 2026-10-29 | Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authen | |
CVE-2026-34260 |
critical | 9.6 | 0.0047 | 2026-10-29 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that a | |
CVE-2026-34263 |
critical | 9.6 | 0.0061 | 2026-10-29 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticate | |
CVE-2026-40129 |
medium | 4.3 | 0.0026 | 2026-10-29 | Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and | |
CVE-2026-40131 |
low | 3.4 | 0.0017 | 2026-10-29 | SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynam | |
CVE-2026-40132 |
medium | 5.4 | 0.0019 | 2026-10-29 | Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizar | |
CVE-2026-40133 |
medium | 6.3 | 0.0022 | 2026-10-29 | Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated | |
CVE-2026-40134 |
medium | 4.3 | 0.0020 | 2026-10-29 | Due to insufficient authorization checks in the SAP Incentive and Commission Management ap | |
CVE-2026-40135 |
medium | 6.5 | 0.0140 | 2026-10-29 | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for A | |
CVE-2026-40136 |
medium | 4.3 | 0.0029 | 2026-10-29 | SAP Financial Consolidation allows an authenticated attacker to disconnect other users by | |
CVE-2026-40137 |
medium | 6.1 | 0.0021 | 2026-10-29 | SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to cra | |
CVE-2026-45430 |
high | 7.1 | 0.0015 | 2026-10-29 | The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random sta | |
CVE-2026-7255 |
medium | 6.5 | 0.0020 | 2026-10-29 | ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attemp | |
CVE-2026-7256 |
high | 8.8 | 0.0101 | 2026-10-29 | ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zy | |
CVE-2026-7257 |
medium | 4.4 | 0.0011 | 2026-10-29 | ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability | |
CVE-2026-7287 |
high | 7.5 | 0.0031 | 2026-10-29 | ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc | |
CVE-2026-41530 |
medium | 4.6 | 0.0015 | 2026-10-29 | The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains | |
CVE-2026-41872 |
critical | 9.1 | 0.0016 | 2026-10-29 | "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate vali | |
CVE-2026-0541 |
high | 7.3 | 0.0010 | 2026-10-29 | ACAP applications can gain elevated privileges due to improper input validation during the | |
CVE-2026-0802 |
high | 7.3 | 0.0040 | 2026-10-29 | An ACAP configuration file lacked sufficient input validation, which could allow command i | |
CVE-2026-0804 |
high | 7.3 | 0.0013 | 2026-10-29 | An ACAP configuration file lacked sufficient input validation, which could allow a path tr | |
CVE-2026-1185 |
high | 8.8 | 0.0023 | 2026-10-29 | A configuration file on the local file system had improper input validation which could al | |
CVE-2026-1681 |
medium | 6.1 | 0.0014 | 2026-10-29 | Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address cause | |
CVE-2026-35227 |
high | 8.2 | 0.0035 | 2026-10-29 | An unauthenticated remote attacker may exhaust all available TCP connections in the CODESY | |
CVE-2026-39432 |
high | 8.2 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Co | |
CVE-2024-54017 |
medium | 6.9 | 0.0031 | 2026-10-29 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SI | |
CVE-2025-40946 |
high | 7.2 | 0.0019 | 2026-10-29 | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 10 | |
CVE-2025-40947 |
high | 7.7 | 0.0054 | 2026-10-29 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGG | |
CVE-2025-40948 |
medium | 6.1 | 0.0040 | 2026-10-29 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGG | |
CVE-2025-40949 |
high | 8.9 | 0.0067 | 2026-10-29 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGG | |
CVE-2026-22924 |
high | 8.8 | 0.0030 | 2026-10-29 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected | |
CVE-2026-22925 |
high | 8.7 | 0.0032 | 2026-10-29 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected | |
CVE-2026-27662 |
high | 7.0 | 0.0011 | 2026-10-29 | Affected devices do not properly restrict access to the web browser via the Control Panel | |
CVE-2026-33862 |
high | 8.5 | 0.0019 | 2026-10-29 | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamc | |
CVE-2026-33893 |
high | 8.7 | 0.0029 | 2026-10-29 | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamc | |
CVE-2026-41551 |
critical | 9.3 | 0.0049 | 2026-10-29 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions con | |
CVE-2026-44411 |
high | 7.3 | 0.0010 | 2026-10-29 | A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). | |
CVE-2026-44412 |
high | 7.3 | 0.0011 | 2026-10-29 | A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). | |
CVE-2026-6001 |
high | 8.8 | 0.0024 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. | |
CVE-2026-7428 |
critical | 9.2 | 0.0024 | 2026-10-29 | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB | |
CVE-2026-8072 |
critical | 9.2 | 0.0015 | 2026-10-29 | Insecure generation of credentials in the local SAT (Technical Support) access functionali | |
CVE-2026-2465 |
high | 8.8 | 0.0023 | 2026-10-29 | Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and | |
CVE-2026-32684 |
low | 2.9 | 0.0009 | 2026-10-29 | The application does not impose strict enough restrictions on directory access permissions | |
CVE-2026-41712 |
high | 7.5 | 0.0026 | 2026-10-29 | Spring AI's chat memory component contained a problematic default that, when not explicitl | |
CVE-2026-41713 |
high | 8.2 | 0.0022 | 2026-10-29 | A malicious user could craft input that is stored in conversation memory and later interpr | |
CVE-2026-42741 |
high | 8.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-42742 |
high | 8.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne |